Type
Collected Rules & Regulations
Category
Chapter 430: Research Security


Executive Order No. 53, Issued 7-31-2026.

  1. Purpose
    1. This policy sets forth system-wide International Travel authorization requirements to maintain compliance with applicable U.S. export and research security requirements.
  2. Scope
    1. This policy applies to University Business and Personal International Travel undertaken by

      1. all employees, except for Student Employees as defined CRR

        320.050 (a student will be covered only if the individual meets one or more of the criteria below);

      2. guest affiliate unpaid appointees;
      3. students conducting or supporting externally funded research; and
      4. any individual listed on a Technology Control Plan or Research Security Risk Mitigation Plan.
    2. The review and authorization requirements outlined by this policy are in addition to any other approvals required under university policies.
  3. Policy Statement
    1. This policy establishes requirements for review and authorization of International Travel by the Director of Research Security and Compliance or designee and the Traveler’s administrative superior in accordance with standard operating procedures established by each university for the following:
      1. International Travel to conduct University Business;
      2. Personal International Travel to Comprehensively Sanctioned or Embargoed Countries or Foreign Countries of Concern where University Property (e.g., computers, cell phones, equipment) will be taken with the Traveler; or
      3. Personal International Travel to Comprehensively Sanctioned or Embargoed Countries or Foreign Countries of Concern where the Traveler will Access University Resources or Systems (e.g., accessing University e-mail from a personal electronic device such as laptop, cell phone, tablet, or similar devices)
    2. International Travel to conduct University Business must be authorized in advance by Research Security and Compliance.
      1. International Travel authorization requests to Comprehensively Sanctioned or Embargoed Countries must be submitted at least 6 months in advance and may require U.S. government authorization. 
        (1) Requests submitted less than 6 months in advance will be considered on a case-by-case basis. The Traveler must, in addition to submitting the appropriate form for International Travel Authorization, contact the appropriate Research Security and Compliance representative at their university to request an expedited review.
      2. International Travel authorization requests to all other countries must be submitted no less than 21 days prior to the departure date.
        (1) Requests submitted less than 21 days in advance will be considered on a case-by-case basis. The Traveler must, in addition to submitting the appropriate form for International Travel Authorization, contact the appropriate Research Security and Compliance representative at their university to request an expedited review.
    3. Personal International Travel where University Property (e.g., computers, cell phones, equipment) will be taken with the Traveler or where the Traveler will Access University Resources or Systems (e.g., accessing University e-mail from a personal electronic device such as laptop, cell phone, tablet, or similar devices) must be authorized in advance by Research Security and Compliance when travelling to a Comprehensively Sanctioned or Embargoed Country or a Foreign Country of Concern.
      1. Authorization under this section applies only to the use, transport, or Access of University Property or University Resources or Systems during Personal International Travel and does not constitute approval of the travel itself.
      2. International Travel authorization requests to Comprehensively Sanctioned or Embargoed Countries must be submitted at least 6 months in advance and may require U.S. government authorization.
        (1) Requests submitted less than 6 months in advance will be considered on a case-by-case basis. The Traveler must, in addition to submitting the appropriate form for International Travel Authorization, contact the appropriate Research Security and Compliance representative at their university to request an expedited review.
      3. International Travel authorization requests to Foreign Countries of Concern must be submitted no less than 21 days prior to the departure date.
        (1) Requests submitted less than 21 days in advance will be reviewed on a case-by-case basis. The Traveler must, in addition to submitting the appropriate form for International Travel Authorization, contact the appropriate Research Security and Compliance representative at their university to request an expedited review.
    4. Personal International Travel is not subject to review and authorization under this policy if the Traveler is:
      1. Not taking University Property to Comprehensively Sanctioned or Embargoed Countries or Foreign Countries of Concern;
      2. Will not be Accessing University Resources or Systems from Comprehensively Sanctioned or Embargoed Countries or Foreign Countries of Concern; or
      3. Travelling to countries other than Comprehensively Sanctioned or Embargoed Countries or Foreign Countries of Concern even when taking University Property or accessing University Resources or Systems.
    5. International Travel subject to this policy requires prior written administrative superior approval using each university’s approved travel authorization system.
  4. Exceptions
    1. Limited exceptions may be granted by the UM System Director of Research Security and Compliance in consultation with the Vice Chancellor of Research or designee.
  5. Appeals
    A Traveler whose International Travel authorization request is denied may appeal the decision by submitting a written appeal to the Chancellor of the Traveler's University within seven calendar days of receiving notice of the denial.
  6. Definitions
    1. Access – To connect to, use, view, retrieve, transmit, store, modify, administer, or otherwise interact with University Resources or Systems.
    2. Comprehensively Sanctioned or Embargoed Countries – Countries subject to broad U.S. government sanctions. The current list of countries can be obtained from Research Security and Compliance.
    3. Foreign Countries of Concern – Countries identified by federal or state authorities as posing elevated research security risks. The current list of countries can be obtained from Research Security and Compliance.
    4. International Travel – Travel outside of the U.S. and its territories.
    5. International Travel Authorization – Formal approval of International Travel by the university.
    6. Personal International Travel – International Travel that is not conducted in the course of University Business.
    7. Research Security Risk Mitigation Plan – A formal plan that identifies potential risks to university research to include foreign interference or undue influence and defines proportionate measures implemented to reduce those risks.
    8. Technology Control Plan (TCP) – A formal document that governs the conduct of controlled research projects. Individuals who are on TCPs are read into controlled projects by Research Security and Compliance and the project lead.
    9. Traveler – Any individual subject to the scope of this policy who is conducting International Travel.
    10. University Business – Travel conducted in the course of university duties whether or not supported by university funds.
    11. University Property – University-owned equipment, data, devices, or materials.
    12. University Resources or Systems – Any system, platform, application, service, network, repository, or technology resource through which University information may be accessed, stored, processed, transmitted, or managed, regardless of ownership, hosting location, authentication method, licensing arrangement, or management responsibility. Examples include email, file storage services, research computing environments, collaboration platforms, enterprise applications, and cloud-based services.
  7. Non-Compliance
    1. Consequences for failure to comply with the requirements set forth in this policy may include but are not limited to:
      1. Denial of Travel Authorization or reimbursement;
      2. Suspension of Access to University Property or University Resources or Systems during International Travel;
      3. Disciplinary actions in accordance with applicable procedures up to and including termination of employment or expulsion from the university;
      4. Revocation of Access to University Systems and Resources;
      5. Revocation of Access to University Property; and
      6. Referral to appropriate authorities in cases involving potential violations of U.S. export control or sanction laws, other laws or regulations, or sponsor requirements.